Trojan.MulDrop31.31179

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\EMAIL Safe Storage 10.2.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EMAIL Safe Storage 10.2.46] 'ImagePath' = '%ALLUSERSPROFILE%\EMAIL Safe Storage 10.2.46\EMAIL Safe Storage 10.2.46.exe'

Создает следующие сервисы

'EMAIL Safe Storage 10.2.46' %ALLUSERSPROFILE%\EMAIL Safe Storage 10.2.46\EMAIL Safe Storage 10.2.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-n26bj.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\zexter video codec\is-60tgm.tmp
%LOCALAPPDATA%\zexter video codec\is-rnft3.tmp
%LOCALAPPDATA%\zexter video codec\is-4k1ge.tmp
%LOCALAPPDATA%\zexter video codec\is-k68ou.tmp
%LOCALAPPDATA%\zexter video codec\is-o36qa.tmp
%LOCALAPPDATA%\zexter video codec\is-dukp7.tmp
%LOCALAPPDATA%\zexter video codec\is-v4jnf.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgv92.tmp
%LOCALAPPDATA%\zexter video codec\is-rteiv.tmp
%LOCALAPPDATA%\zexter video codec\is-fp84e.tmp
%LOCALAPPDATA%\zexter video codec\is-fd5hg.tmp
%LOCALAPPDATA%\zexter video codec\is-1nm75.tmp
%LOCALAPPDATA%\zexter video codec\is-fvkvu.tmp
%LOCALAPPDATA%\zexter video codec\is-v3ahu.tmp
%LOCALAPPDATA%\zexter video codec\is-sm28q.tmp
%LOCALAPPDATA%\zexter video codec\is-540aq.tmp
%LOCALAPPDATA%\zexter video codec\is-70ava.tmp
%LOCALAPPDATA%\zexter video codec\is-vkt0f.tmp
%LOCALAPPDATA%\zexter video codec\is-955nt.tmp
%LOCALAPPDATA%\zexter video codec\is-etnen.tmp
%LOCALAPPDATA%\zexter video codec\uninstall\unins000.dat
%LOCALAPPDATA%\zexter video codec\is-kesrp.tmp
%LOCALAPPDATA%\zexter video codec\is-0shg7.tmp
%LOCALAPPDATA%\zexter video codec\is-ds435.tmp
%LOCALAPPDATA%\zexter video codec\is-smcud.tmp
%LOCALAPPDATA%\zexter video codec\is-0jkhg.tmp
%LOCALAPPDATA%\zexter video codec\is-i7t9v.tmp
%LOCALAPPDATA%\zexter video codec\is-331gq.tmp
%LOCALAPPDATA%\zexter video codec\is-4hbm6.tmp
%LOCALAPPDATA%\zexter video codec\is-uc52v.tmp
%LOCALAPPDATA%\zexter video codec\is-umnvl.tmp
%LOCALAPPDATA%\zexter video codec\is-q652l.tmp
%LOCALAPPDATA%\zexter video codec\is-24093.tmp
%LOCALAPPDATA%\zexter video codec\is-rv56e.tmp
%LOCALAPPDATA%\zexter video codec\is-ruu2i.tmp
%LOCALAPPDATA%\zexter video codec\is-nef67.tmp
%LOCALAPPDATA%\zexter video codec\is-spfhn.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bofbk.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgp76.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-cpa95.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-md5m4.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pi8e4.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2pj00.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-it8mq.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-8s2ie.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-3s06q.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ggjar.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-ttd8n.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-h731d.tmp
%LOCALAPPDATA%\zexter video codec\uninstall\is-st7pj.tmp
%TEMP%\is-82f09.tmp\_isetup\_iscrypt.dll
%TEMP%\is-82f09.tmp\_isetup\_isdecmp.dll
%TEMP%\is-82f09.tmp\_isetup\_shfoldr.dll
%TEMP%\is-82f09.tmp\_isetup\_setup64.tmp
%TEMP%\is-82f09.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\zexter video codec\themes\is-ftfmo.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2so7c.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4qq4c.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tpr3a.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-t0650.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-kaksb.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-31uc7.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-v62pg.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-atl67.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5fll0.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tov0q.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ncuj1.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5597t.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-iih3m.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-b25h7.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4jnp0.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pq72g.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-9pli8.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-q8mj2.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2vd4m.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-na6e8.tmp
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-h8e20.tmp
%LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe
%ALLUSERSPROFILE%\email safe storage 10.2.46\email safe storage 10.2.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\zexter video codec\uninstall\is-st7pj.tmp в %LOCALAPPDATA%\zexter video codec\uninstall\unins000.exe
%LOCALAPPDATA%\zexter video codec\is-4k1ge.tmp в %LOCALAPPDATA%\zexter video codec\libiconv-2.dll
%LOCALAPPDATA%\zexter video codec\is-k68ou.tmp в %LOCALAPPDATA%\zexter video codec\libharfbuzz-0.dll
%LOCALAPPDATA%\zexter video codec\is-o36qa.tmp в %LOCALAPPDATA%\zexter video codec\libgraphite2.dll
%LOCALAPPDATA%\zexter video codec\is-dukp7.tmp в %LOCALAPPDATA%\zexter video codec\libgomp-1.dll
%LOCALAPPDATA%\zexter video codec\is-v4jnf.tmp в %LOCALAPPDATA%\zexter video codec\libgobject-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-rteiv.tmp в %LOCALAPPDATA%\zexter video codec\libgmodule-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-rnft3.tmp в %LOCALAPPDATA%\zexter video codec\libintl-8.dll
%LOCALAPPDATA%\zexter video codec\is-70ava.tmp в %LOCALAPPDATA%\zexter video codec\libglibmm-2.4-1.dll
%LOCALAPPDATA%\zexter video codec\is-fd5hg.tmp в %LOCALAPPDATA%\zexter video codec\libgiomm-2.4-1.dll
%LOCALAPPDATA%\zexter video codec\is-1nm75.tmp в %LOCALAPPDATA%\zexter video codec\libgio-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-fvkvu.tmp в %LOCALAPPDATA%\zexter video codec\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-v3ahu.tmp в %LOCALAPPDATA%\zexter video codec\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\zexter video codec\is-sm28q.tmp в %LOCALAPPDATA%\zexter video codec\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-540aq.tmp в %LOCALAPPDATA%\zexter video codec\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\zexter video codec\is-fp84e.tmp в %LOCALAPPDATA%\zexter video codec\libglib-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-umnvl.tmp в %LOCALAPPDATA%\zexter video codec\libpixman-1-0.dll
%LOCALAPPDATA%\zexter video codec\is-0shg7.tmp в %LOCALAPPDATA%\zexter video codec\zlib1.dll
%LOCALAPPDATA%\zexter video codec\is-4hbm6.tmp в %LOCALAPPDATA%\zexter video codec\liblzma-5.dll
%LOCALAPPDATA%\zexter video codec\is-ds435.tmp в %LOCALAPPDATA%\zexter video codec\libxml2-2.dll
%LOCALAPPDATA%\zexter video codec\is-smcud.tmp в %LOCALAPPDATA%\zexter video codec\libwinpthread-1.dll
%LOCALAPPDATA%\zexter video codec\is-0jkhg.tmp в %LOCALAPPDATA%\zexter video codec\libtiff-5.dll
%LOCALAPPDATA%\zexter video codec\is-i7t9v.tmp в %LOCALAPPDATA%\zexter video codec\libstdc++-6.dll
%LOCALAPPDATA%\zexter video codec\is-spfhn.tmp в %LOCALAPPDATA%\zexter video codec\libsigc-2.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-etnen.tmp в %LOCALAPPDATA%\zexter video codec\librsvg-2-2.dll
%LOCALAPPDATA%\zexter video codec\is-vkt0f.tmp в %LOCALAPPDATA%\zexter video codec\libfreetype-6.dll
%LOCALAPPDATA%\zexter video codec\is-uc52v.tmp в %LOCALAPPDATA%\zexter video codec\libpng16-16.dll
%LOCALAPPDATA%\zexter video codec\is-q652l.tmp в %LOCALAPPDATA%\zexter video codec\libpcre-1.dll
%LOCALAPPDATA%\zexter video codec\is-24093.tmp в %LOCALAPPDATA%\zexter video codec\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-rv56e.tmp в %LOCALAPPDATA%\zexter video codec\libpangomm-1.4-1.dll
%LOCALAPPDATA%\zexter video codec\is-ruu2i.tmp в %LOCALAPPDATA%\zexter video codec\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-nef67.tmp в %LOCALAPPDATA%\zexter video codec\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-331gq.tmp в %LOCALAPPDATA%\zexter video codec\libpango-1.0-0.dll
%LOCALAPPDATA%\zexter video codec\is-60tgm.tmp в %LOCALAPPDATA%\zexter video codec\libjpeg-8.dll
%LOCALAPPDATA%\zexter video codec\is-955nt.tmp в %LOCALAPPDATA%\zexter video codec\liblcms2-2.dll
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgv92.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\trough2.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2vd4m.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-insensitive.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-b25h7.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tpr3a.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2so7c.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ggjar.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-right-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4qq4c.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-md5m4.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-h8e20.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pi8e4.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-left-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-it8mq.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-8s2ie.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down-ins.png
%LOCALAPPDATA%\zexter video codec\themes\is-3s06q.tmp в %LOCALAPPDATA%\zexter video codec\themes\system.iconset
%LOCALAPPDATA%\zexter video codec\themes\is-ttd8n.tmp в %LOCALAPPDATA%\zexter video codec\themes\slim
%LOCALAPPDATA%\zexter video codec\themes\is-ftfmo.tmp в %LOCALAPPDATA%\zexter video codec\themes\92-beige-darkcyan.iconset
%LOCALAPPDATA%\zexter video codec\themes\is-h731d.tmp в %LOCALAPPDATA%\zexter video codec\themes\92-beige-darkcyan.gtkrc
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-2pj00.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-down.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-ncuj1.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bgp76.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-q8mj2.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-normal.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-cpa95.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-t0650.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-v-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-31uc7.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-v62pg.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-atl67.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\slider-h-ins.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5fll0.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-bofbk.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\trough2-h.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-tov0q.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\rangeslider-pre.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-5597t.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\pbtroughv.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-kaksb.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\pbtroughh.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-iih3m.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\null.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-4jnp0.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-pressed.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-pq72g.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-prelight.png
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-9pli8.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\button-normal.xcf
%LOCALAPPDATA%\zexter video codec\themes\gray_textured\is-na6e8.tmp в %LOCALAPPDATA%\zexter video codec\themes\gray_textured\arrow-up.png
%LOCALAPPDATA%\zexter video codec\is-kesrp.tmp в %LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe

Другое

Ищет следующие окна

ClassName: '' WindowName: 'Tc912d_emBox1023_Tc912d'

Создает и запускает на исполнение

'%TEMP%\is-n26bj.tmp\<Имя файла>.tmp' /SL5="$5024A,8066431,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\zexter video codec\zextervideocodec32_64.exe' -i

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней